Justin Willhite b26c174628 fix(oauth): normalize the discovery base so a session JMAP_SERVER_URL refreshes (#971) ...

OAuth authorization-server metadata lives at the origin root (RFC 8414), but
getRequiredConfig() derived the discovery URL straight from JMAP_SERVER_URL. When
that is the session URL (for example https://mail.example.com/jmap/session, a
common setup so the client can skip the 307 redirect a preflighted CORS request
cannot follow), discoverOAuth fetched
https://mail.example.com/jmap/session/.well-known/oauth-authorization-server,
got a 404, and token refresh failed with "OAuth token endpoint not found", so the
session was dropped after one access-token lifetime.

Strip a trailing session path (/jmap/session or /.well-known/jmap, plus any query
or fragment) before discovery. A plain server root is unchanged, and only the
session suffix is removed, so a real base path prefix is kept.

Adds oauth-discovery-base.test.ts driving getRequiredConfig; the normalization
cases fail without the fix.

2026-09-08 19:17:18 +00:00

..

cookie-config.ts

fix: honor cookieSameSite admin config override #284

2026-05-14 21:49:37 +02:00

discovery.ts

fix(oauth): harden OIDC discovery (timeout, retry, serve-stale)

2026-07-16 17:56:19 +02:00

pkce-server.ts

feat: add non-interactive SSO login flow for embedded/iframe deployments (closes #69)

2026-03-21 20:45:19 +01:00

pkce.ts

feat: add OAuth2/OIDC with PKCE for SSO login

2026-02-25 23:41:37 +01:00

token-exchange.ts

fix(oauth): normalize the discovery base so a session JMAP_SERVER_URL refreshes (#971)

2026-09-08 19:17:18 +00:00

tokens.ts

fix: reuse cached access token on session restore #552

2026-08-16 22:20:07 +02:00